Technique.View on attack.mitre.org
Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.
Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings. Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. Domain or Tenant Policy Modification) for their benefit.
Rules on DetectionCode tagged with T1615.
| Rule | Level | Log source |
|---|---|---|
| HackTool - SharpUp PrivEsc Tool Execution | critical | windows / process_creation |
| Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS | high | windows / process_creation |
| Gpresult Display Group Policy Information | medium | windows / process_creation |
| Potential Reconnaissance Activity Via GatherNetworkInfo.VBS | medium | windows / process_creation |
| Suspicious GPO Discovery With Get-GPO | low | windows / ps_script |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Windows WinPEAS PowerShell Script Execution | TTP | NULL | Powershell Script Block Logging 4104 |
| Used by | Procedure example |
|---|---|
| GroupTurla | Turla surveys a system upon check-in to discover Group Policy details using the |
| Used by | Procedure example |
|---|---|
| ToolBloodHound | BloodHound has the ability to collect local admin information via GPO. |
| MalwareDUSTTRAP | DUSTTRAP can identify victim environment Group Policy information. |
| MalwareEmissary | Emissary has the capability to execute |
| ToolEmpire | Empire includes various modules for enumerating Group Policy. |
| MalwareLunarWeb | LunarWeb can capture information on group policy settings |
| Used by | Procedure example |
|---|---|
| CampaignLeviathan Australian Intrusions | Leviathan performed extensive Active Directory enumeration of victim environments during Leviathan Australian Intrusions. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
